Will HHS make determinations as to whether a provision of state law is “more stringent” than or “contrary” to a provision of the HIPAA Privacy Rule?

Answer:

The Department of Health and Human Services (HHS) will not make determinations as to whether a provision of State law is "more stringent" than a provision of the Privacy Rule. HIPAA's Administrative Simplification Rules provide a general exception to preemption for more stringent, contrary State laws. Because such an exception already exists, it is neither necessary nor appropriate to request a preemption exception determination from HHS. Further, HHS will not determine whether a provision is "contrary" to the Privacy Rule, except in the context of, and as necessary to, making an exception determination for State laws that meet one or more of the criteria listed at 45 CFR 160.203, links to an external website(a).

See 45 C.F.R. 160.202, links to an external website for the definitions of "more stringent" and "contrary."  View an unofficial version of the Privacy Rule and the preemption requirements.

Created 3/12/03